Data communication system and method

Abstract

A data communications method and system is disclosed in which the transmission control protocol (TCP) is used for data communications. In order to provide security against denial of service attacks and the like, a connection negotiation phase is required before the TCP handshake. Without a successful connection negotiation, a TCP handshake is unable to complete thereby preventing connection.

Description

FIELD OF THE INVENTION [0001] The present invention relates to a system and method for securing data communications over a network and is particularly relevant to networks using the Transmission Control Protocol (TCP). BACKGROUND TO THE INVENTION [0002] In data communications, Internet Protocol (IP) networks have become pervasive. In particular, the majority of public data communication networks, particularly the Internet, use IP. Given the availability of cheap, high speed, access to public data communications networks using DSL connections or similar, many organisations wish to use these networks to provide interconnectivity between trusted areas or devices. The trusted devices may be located, for example at branch offices or homes. Trusted areas would include networks within corporate offices. [0003] However, by connecting trusted areas and devices to public networks, they become open to attack and abuse. This means that organisations are forced to take defensive measures against...

AI Technical Summary

Benefits of technology

[0029] The present invention seeks to provide a solution for protecting against these attacks whilst at the same time providing a scalable and flexible method for exchanging data securely over Public IP networks using TCP connections. In particular the use of specific datagrams for session establishment provides for the end-point devices, initiator and receiver, to be invisible to attackers on the Public IP infrastructure. TCP is chosen as a reliable data carrier over IP networks.

Problems solved by technology

However, by connecting trusted areas and devices to public networks, they become open to attack and abuse.

This means that organisations are forced to take defensive measures against attack.

Unfortunately, it is well known that existing session establishment for TCP over IP networks is inherently insecure and prone to exploitation by Active and Intrusion attacks.

Denial of service (DoS) attacks cost businesses millions of dollars each year and are now a serious threat to any system or network connected to a public network.

These costs are related to system downtime, lost revenues and the labour involved in identifying and reacting to such attacks.

Essentially, a DoS attack disrupts or completely denies services to legitimate users, networks, systems or other resources.

The intent of such attacks is usually malicious and often takes little skill or resources because the requisite tools are readily available.

While the standard 3-way handshake works well most of the time, most systems have only a finite number of resources available for setting up connections and potential.

While most systems can sustain hundreds of concurrent connections to a specific port, it may only take a dozen or so potential connection requests to exhaust all resources allocated to setting up connections.

It is this weakness that attackers use to disable a system.

The system under attack will never be able to clear the queue before receiving new SYN requests.

However, if a TCP / IP system is to communicate successfully with another at least one port must be left open and this in itself creates a vulnerability when the connection is over a public network.

Images